Fixes: #2669 forceSSL doesn't work

html/index.php

@@ -188,20 +188,6 @@ if ($_SERVER["REQUEST_METHOD"] != "POST") {
   @DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__, $lang, "Setting language to");
 }
 
-/* Check for SSL connection */
-$ssl = "";
-if (!isset($_SERVER['HTTPS']) ||
-    !stristr($_SERVER['HTTPS'], "on")) {
-
-  if (empty($_SERVER['REQUEST_URI'])) {
-    $ssl = "https://".$_SERVER['HTTP_HOST'].
-      $_SERVER['PATH_INFO'];
-  } else {
-    $ssl = "https://".$_SERVER['HTTP_HOST'].
-      $_SERVER['REQUEST_URI'];
-  }
-}
-
 /* Do we have htaccess authentification enabled? */
 $htaccess_authenticated = FALSE;
 if ($config->get_cfg_value("htaccessAuthentication") == "TRUE" ) {
@@ -234,7 +220,7 @@ if (!$htaccess_authenticated) {
 $config->set_current($server);
 
 /* If SSL is forced, just forward to the SSL enabled site */
-if ($config->get_cfg_value("forcessl") == "TRUE" && $ssl != '') {
+if (($config->get_cfg_value("forcessl") == "TRUE") && ($ssl != '')) {
   header ("Location: $ssl");
   exit;
 }

html/main.php

@@ -62,6 +62,13 @@ if ($_SERVER['REMOTE_ADDR'] != $ui->ip) {
   exit;
 }
 $config = session::global_get('config');
+
+/* If SSL is forced, just forward to the SSL enabled site */
+if (($config->get_cfg_value("forcessl") == "TRUE") && ($ssl != '')) {
+  header ("Location: $ssl");
+  exit;
+}
+
 timezone::get_default_timezone();
 
 /* Check for invalid sessions */

html/recovery.php

 <?php
-
 /*
   This code is part of FusionDirectory (http://www.fusiondirectory.org/)
-  Copyright (C) 2003-2010  Cajus Pollmeier
   Copyright (C) 2011-2013  FusionDirectory
 
   This program is free software; you can redistribute it and/or modify
@@ -24,6 +22,15 @@ require_once("../include/php_setup.inc");
 require_once("functions.inc");
 require_once("variables.inc");
 
+$config = session::global_get('config');
+
+/* If SSL is forced, just forward to the SSL enabled site */
+if (($config->get_cfg_value("forcessl") == "TRUE") && ($ssl != '')) {
+  header ("Location: $ssl");
+  exit;
+}
+
+
 $pwRecovery = new passwordRecovery();
 
 $pwRecovery->execute();

include/php_setup.inc

@@ -297,4 +297,14 @@ if (defined('SMARTY_PHP_REMOVE')) {
 } else {
     $smarty->php_handling = Smarty::PHP_REMOVE;
 }
+
+/* Check for SSL connection */
+$ssl = "";
+if (!(isset($_SERVER['HTTPS']) && stristr($_SERVER['HTTPS'], "on"))) {
+  if (empty($_SERVER['REQUEST_URI'])) {
+    $ssl = "https://".$_SERVER['HTTP_HOST'].$_SERVER['PATH_INFO'];
+  } else {
+    $ssl = "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
+  }
+}
 ?>

setup/class_setupStep_Config3.inc

@@ -221,6 +221,7 @@ class Step_Config3 extends setup_step
     $attrs['fdListSummary'] = ($this->optional['list_summary']?"TRUE":"FALSE");
     $attrs['fdLdapStats']   = ($this->optional['ldapstats']?"TRUE":"FALSE");
     $attrs['fdWarnSSL']     = ($this->optional['warnssl']?"TRUE":"FALSE");
+    $attrs['fdForceSSL']    = ($this->optional['forcessl']?"TRUE":"FALSE");
 
     if ($cv['pwd_rules']['pwminlen_active']) {
       $attrs['fdPasswordMinLength'] = $cv['pwd_rules']['pwminlen'];